Exact synthesis of multi-qubit Clifford+T circuits 
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We prove that a unitary matrix has an exact representation over the Clifford+T gate set with local 
ancillas if and only if its entries are in the ring Z[-^,i]. Moreover, we show that one ancilla always 
suffices. These facts were conjectured by Kliuchnikov, Maslov, and Mosca. We obtain an algorithm 
for synthesizing a exact Clifford+T circuit from any such n-qubit operator. We also characterize the 
Clifford+T operators that can be represented without ancillas. 



1 Introduction 

An important problem in quantum information theory 
is the decomposition of arbitrary unitary operators into 
gates from some fixed universal set [5j. Depending on 
the operator to be decomposed, this may either be done 
exactly or to within some given accuracy e; the former 
problem is known as exact synthesis and the latter as 
approximate synthesis [5]. 

Here, we focus on the problem of exact synthesis for 
n-qubit operators, using the Clifford+T universal gate 
set. Recall that the Clifford group on n qubits is gen- 
erated by the Hadamard gate H, the phase gate S, the 
controlled-not gate, and the scalar u = e l7r / 4 (one may 
allow arbitrary unit scalars, but it is not convenient for 
our purposes to do so). It is well-known that one obtains 
a universal gate set by adding the non-Clifford operator 
T®. 
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In addition to the Clifford+T group on n qubits, as de- 
fined above, we also consider the slightly larger group of 
Clifford+T operators "with ancillas" . We say that an n- 
qubit operator U is a Clifford+T operator with ancillas 
if there exists m > and a Clifford+T operator U' on 
n + m qubits, such that U'{\(f>) <g> |0)) = (U\<j>)) ® |0) for 
all n-qubit states \<f>). 

Kliuchnikov, Maslov, and Mosca [3] showed that a 
singlc-qubit operator U is in the Clifford+T group if and 
only if all of its matrix entries belong to the ring Z[-^=, £]. 
They also showed that the Clifford+T groups "with an- 
cillas" and "without ancillas" coincide for n = 1, but 
not for n > 2. Moreover, Kliuchnikov et al. conjectured 
that for all n, an n-qubit operator U is in the Clifford+T 
group with ancillas if and only if its matrix entries be- 



long to Z[A=,i]. They also conjectured that a single 
ancilla qubit is always sufficient in the representation of 
a Clifford+T operator with ancillas. The purpose of this 
paper is to prove these conjectures. In particular, this 
yields an algorithm for exact Clifford+T synthesis of n- 
qubit operators. We also obtain a characterization of the 
Clifford+T group on n qubits without ancillas. 

It is important to note that, unlike in the single-qubit 
case, the circuit synthesized here are not in any sense 
canonical, and very far from optimal. Thus, the question 
of efficient synthesis is not addressed here. 

2 Statement of the main result 

Consider the ring Z[-^=,i], consisting of complex num- 
bers of the form 



— (a + bi + cV2 + diV2), 

On x 7 ' 



where n £ N and a, b,c,d E Z. Our goal is to prove 
the following theorem, which was conjectured by Kli- 
uchnikov et al. [3]: 

Theorem 1. Let U be a unitary 2™ x 2™ matrix. Then 
the following are equivalent: 

(a) U can be exactly represented by a quantum circuit 
over the Clifford+T gate set, possibly using some 
finite number of ancillas that are initialized and fi- 
nalized in state |0). 

(b) The entries of U belong to the ring 
Moreover, in (a), a single ancilla is always sufficient. 



3 Some algebra 

We first introduce some notation and terminology, fol- 
lowing [3] where possible. Recall that N is the set 
of natural numbers including 0, and Z is the ring of 
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integers. We write Z 2 = Z/2Z for the ring of integers 
modulo 2. Let B be the ring of dyadic fractions, defined 
as B = Z[§] = {§, I a £ Z, n G N}. 

Let w = e l7r/4 = (1 + i)/y/2. Note that oj is an 8th 
root of unity satisfying oj 2 — i and cj 4 = —1. We will 
consider three different rings related to ui: 

Definition 2. Consider the following rings. Note that 
the first two are subrings of the complex numbers, and 
the third one is not: 

• D[oj] = {aoj 3 + boj 2 + coj + d \ a,b,c,d G B}. 

• Z[oj] = {aoj 3 + boj 2 + coj + d\a,b,c,d£ Z}. 

• Z 2 [w] = {pu 3 + quj 2 + roj + s | p,q,r,s £ Z 2 }. 

Note that the ring Z 2 [u;] only has 16 elements. The laws 
of addition and multiplication are uniquely determined 
by the ring axioms and the property oj 4 = 1 (mod 2). 
We call the elements of Z 2 [w] residues (more precisely, 
residue classes of Z[ui] modulo 2). 

Remark 3. The ring B[u>] is the same as the ring 
Z[^=, i] mentioned in the statement of Theorem [TJ How- 
ever, as already pointed out in [3J, the formulation in 
terms of oj is far more convenient algebraically. 

Remark 4. The ring Z[oj] is also called the ring of alge- 
braic integers of B[w]. It has an intrinsic definition, i.e., 
one that is independent of the particular presentation of 
B[w]. Namely, a complex number is called an algebraic 
integer if it is the root of some polynomial with integer 
coefficients and leading coefficient 1. It follows that oj, 
i, and v2 are algebraic integers, whereas, for example, 
l/y/2 is not. The ring Z[oj] then consists of precisely 
those elements of B[w] that are algebraic integers. 

3.1 Conjugate and norm 

Remark 5 (Complex conjugate and norm). Since B[w] 
and Z[oj] are subrings of the complex numbers, they in- 
herit the usual notion of complex conjugation. We note 
that oj^ = — to 3 . This yields the following formula: 

(au 3 + boj 2 + clj + d)* = -co; 3 - boj 2 - aoj + d. (2) 

Similarly, the sets D[oj] and Z[uj] inherit the usual norm 
from the complex numbers. It is given by the following 
explicit formula, for t = aoj 3 + boj 2 + coj + d: 

\\t\\ 2 = th = (a 2 +b 2 +c 2 +d 2 ) + (cd+bc+ab-da)V2. (3) 

Definition 6 (Weight). For t £ B[w] or t £ Z[oj], the 
weight of t is denoted ||i||weight> and is given by: 

\\t\\ 2 wcight = a 2 + b 2 +c 2 +d 2 . (4) 

Note that the square of the norm is valued in B[v2], 
whereas the square of the weight is valued in B. We also 



extend the definition of norm and weight to vectors in 
the obvious way: For u = (iij)j, we define 

IMI 2 = H U jl| 2 IMIwcight = Kllwcighf 

3 3 

Lemma 7. Consider a vector u € B[cj] n . If \\u\\ 2 is an 
integer, then |M|^ cight = ||u|| 2 . 

Proof. Any t G D[-y/2] can be uniquely written as t = 
a + by/2, where a, b £ B. We can call a the dyadic part of 
t. Now the claim is obvious, because ||w||^ eight is exactly 
the dyadic part of ||w|| 2 . □ 

3.2 Denominator exponents 

Definition 8. Let t E B[w]. A natural number k £ N 

is called a denominator exponent for t if y/2 t £ Z[u>]. It 
is obvious that such k always exists. The least such k is 
called the least denominator exponent of t. 

More generally, we say that k is a denominator expo- 
nent for a vector or matrix if it is a denominator expo- 
nent for all of its entries. The least denominator expo- 
nent for a vector or matrix is therefore the least k that 
is a denominator exponent for all of its entries. 

Remark 9. Our notion of least denominator exponent is 
almost the same as the "smallest denominator exponent" 
of [3J, except that we do not permit k < 0. 

3.3 Residues 

Remark 10. The ring Z 2 [w] is not a subring of the 
complex numbers; rather, it is a quotient of the ring Z[oj] . 
Indeed, consider the parity function () : Z — > Z 2 , which 
is the unique ring homomorphism. It satisfies a = if a 
is even and a = 1 if a is odd. The parity map induces a 
surjective ring homomorphism p : Z[u>] — > Z 2 [w], defined 

by 

p(a(jj 3 + bui 2 + coj + d) = aoj 3 + bui 2 + coj + d. 

We call p the residue map, and we call p(t) the residue 
of i. 

Convention 11. Since residues will be important for 
the constructions of this paper, we introduce a shortcut 
notation, writing each residue poj 3 + qoj 2 + roj + s as a 
string of binary digits pqrs. 

What makes residues useful for our purposes is that 
many important operations on Z[oj] are well-defined on 
residues. Here, we say that an operation / : Z[oj] — > 
Z[oj] is well-defined on residues if for all t, s, p(t) = p(s) 
implies p(f(t)) = p(f(s)). 

For example, two operations that are obviously well- 
defined on residues are complex conjugation, which takes 
the form (pqrs)^ = rqps by @, and multiplication by ui, 
which is just a cyclic shift oj(pqrs) — qrsp. Table[T]shows 
two other important operations on residues, namely mul- 
tiplication by \/2 and the squared norm. 
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Table 1: Some operations on residues 

Definition 12 (fc-Residue). Let t € 3[u>] and let A: be a 

(not necessarily least) denominator exponent for t. The 
k -residue oft, in symbols Pk{t), is defined to be 

Pk {t) = p{Vtt). 

Definition 13 (Reducibility). We say that a residue 
x G 1d2[u>] is reducible if it is of the form y2y, for some 
y G li2[uj]. Moreover, we say that x G Z2[w] is twice 
reducible if it is of the form 2y, for some y G ^[uj]. 

Lemma 14. For a residue x, the following are equiva- 
lent: 

(a) x is reducible; 

(b) x G {0000, 0101, 1010, 1111}; 

(c) V2x = 0000; 

(d) x*x = 0000. 

Moreover, x is twice reducible iff x — 0000. 

Proof. By inspection of Table [TJ □ 

Lemma 15. Let t G Z[uj]. Then t/2 G Z[w] if and only 
if p(t) is twice reducible, and t/y/2 G Z[w] if and only if 
p{t) is reducible. 

Proof. The first claim is trivial, as pit) = 0000 if and 
only if all components of t are even. For the second claim, 
the left-to-right implication is also trivial: assume t' = 
t/y/2 G Z[u)]. Then p(t) = p(V2i'), which is reducible by 
definition. Conversely, let t G Z[w] and assume that p(t) 
is reducible. Then p(t) G {0000,0101,1010,1111}, and 
it can be seen from Table □ that p(y/2t) = 0000. There- 
fore, y/2t is twice reducible by the first claim; hence t is 
reducible. □ 

Corollary 16. Let t G V>[u>] and let k > be a denom- 
inator exponent for t. Then k is the least denominator 
exponent for t if and only if p kit) is irreducible. 

Proof. Since A: is a denominator exponent for t, we 
k 

have V2 t G Z[w]. Moreover, k is least if and only if 

k—l 

V2 t Z[cj]. By Lemma [T51 this is the case if and 
only if piV% t) = pkit) is irreducible. □ 



Definition 17. The notions of residue, fc-residue, re- 
ducibility, and twice-reducibility all extend in an obvi- 
ous componentwise way to vectors and matrices. Thus, 
the residue of a vector or matrix u is obtained by 
taking the residue of each of its entries, and similar for 
fc-residues. Also, we say that a vector or matrix is re- 
ducible if each of its entries is reducible, and similarly 
for twice-reducibility. 



Example 18. Consider the matrix 
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It has least denominator exponent 3. Its 3-, 4-, and 5- 
residues are: 
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Pb(U) =0. 



4 Decomposition into two- level 
matrices 

Recall that a two-level matrix is an n x n-matrix that 
acts non-trivially on at most two vector components [5] . 
If 

a b 
c d 



U 



is a 2 x 2-matrix and j ^ t, we write Uy i] for the two- 
level n x n-matrix defined by 

... j ... i ... 
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and we say that Uy^ is a two- level matrix of type U. 
Similarly, if a is a scalar, we write for the one-level 
matrix 

... j ... 





( i 
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a b] = j 
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and we say that aui is a one-level matrix of type 
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Lemma 19 (Row operation). Let u = (ui,u 2 ) T G D[w] 2 
be a vector with denominator exponent k > and k- 
residue pk(u) — {x\,X2), such that x\x\ = x\x 2 . Then 
there exists a sequence of matrices U\, . . . , Uh, each of 
which is H or T , such that v — U\ ■ ■ ■ UhU has denom- 
inator exponent k — 1, or equivalently, pk(v) is defined 
and reducible. 

Proof. It can be seen from Table Q] that x\xi is either 
0000, 1010, or 0001. 



Case 1: x\x\ = x\x 2 — 0000. In this case, pk(u) is 
already reducible, and there is nothing to show. 

Case 2: x\x\ — x\x 2 — 1010. In this case, we know 
from Table Q] that x t ,x 2 G {0011,0110,1100,1001}. 
In particular, X\ is a cyclic permutation of x 2 , say, 
x\ = Lu m x 2 . Let v = HT m u. Then 



p k (V2v) = p k { 



Pk\ 



1 
1 

Ul 
Ul 

X\ + uj t 

X\ — uf 



1 

-1 







)(2)> 



"2 
U'2 



\ _ ( 0000 \ 
) - \ 0000 ) 



This shows that pk(V2v) is twice reducible; there- 
fore, pk(v) is defined and reducible as claimed. 

Case 3: x\x\ — x\x 2 = 0001. In this case, we know 
fromTable[T]thatxi,a;2 G {0001, 0010, 0100, 1000}U 
{0111,1110,1101,1011}. If both x-l,x 2 are in the 
first set, or both are in the second set, then X\ and 
x 2 are cyclic permutations of each other, and we 
proceed as in case 2. The only remaining cases are 
that X\ is a cyclic permutation of 0001 and x 2 is a 
cyclic permutation of 0111, or vice versa. But then 
there exists some m such that xi + u> m x 2 — 1111. 
Letting u' = HT m u, we have 



p k (V2u') = pk{ 



-1 



1 

uj m 



(£): 



Pk 



Ul + LU m U 2 
U\— uj m u 2 

X\ + LU m X 2 
X\ — Ul m X 2 



1111 
1111 



Since this is reducible, u' has denominator expo- 
nent k. Let pfe(u') = (2/1,2/2)- Because v2?/i == 
V2y 2 = 1111, we see from Table [1] that 2/1,2/2 G 
{0011,0110,1100,1001} and y{y x = y\y 2 = 1010. 
Therefore, u' satisfies the condition of case 2 above. 
Proceeding as in case 2, we find m! such that 
v = HT m 'u' = HT m ' HT m u has denominator ex- 
ponent k — 1 . This finishes the proof. □ 

Lemma 20 (Column lemma). Consider a unit vector 
u G D[w]", i.e., an n-dimensional column vector of norm 
1 with entries from the ring Then there exist a se- 

quence U\, . . . , Uh of one- and two-level unitary matrices 
of types X , H , T, and uj such that U± • • • UhU — e±, the 
first standard basis vector. 



Proof. The proof is by induction on k, the least denom- 
inator exponent of u. Let u — (u\, . . . , u n ) T . 

• Base case. Suppose k = 0. Then u G Z[w]™. Since 
by assumption ||u|| 2 = 1, it follows by Lemma [7] that 
II u ll weight = 1- Since u\, . . . ,u n are elements of Z[w], 
their weights are non- negative integers. It follows 
that there is precisely one j with \\uj\\ we i g ht = 1, 
and 1 1 1 1 weight = for all I ^ j. Let u' — Xnjiu if 
j ^ 1, and u' = u otherwise. Now u[ is of the form 
uj~ rn , for some m G {0, . . . , 7}, and u' e = for all 
£ 7^ 1. We have = e\, as desired. 

k 

• Induction step. Suppose k > 0. Let v = \/2 u G 

Z[w] n , and let x = pk(u) = p(v). From ||u|| 2 = 1, it 
follows that ||i;|| 2 = v\v\ + ... + v\v n = 2 k . Taking 
residues of the last equation, we have 



x\x\ 



X^Xn = 0000. 



(5) 



It can be seen from Table Q] that each summand 
XjXj is either 0000, 0001, or 1010. Since their sum 
is 0000, it follows that there is an even number of 
j such that XjXj — 0001, and an even number of j 

such that XjXj — 1010. 

We do an inner induction on the number of irre- 
ducible components of x. If x is reducible, then u 
has denominator exponent k — 1 by Corollary II 61 
and we can apply the outer induction hypothesis. 
Now suppose there is some j such that Xj is irre- 
ducible; then XjXj ^ 0000 by Lemma [Ml Because 
of the evenness property noted above, there must 
exist some I ^ j such that XjXj = x^xg. Applying 

Lemma flUl to vf = (uj, ui) T , we find a sequence U of 
row operations of types H and T, making pk{Uu') 
reducible. We can lift this to a two-level operation 
Uu t e\ acting on u; thus pkQJynu) has fewer irre- 
ducible components than x — Pk(u), and the inner 
induction hypothesis applies. □ 

Lemma 21 (Matrix decomposition). Let U be a unitary 
n x n-matrix with entries in D[uj] . Then there exists a se- 
quence U\, . . . ,Uh of one- and two-level unitary matrices 
of types X, H, T , and u such that U = U\ ■ ■ ■ Uh- 

Proof. Equivalently, it suffices to show that there exist 
one- and two- level unitary matrices V±, . . . ,Vh of types 
X, H, T, and uj such that V h • • ■ V\U = I. This is an 
easy consequence of the column lemma, exactly as in 
e.g. [5l Sec. 4.5.1]. Specifically, first use the column 
lemma to find suitable one- and two-level row operations 
Vi, . . . , Vh ± such that the leftmost column of Vh 1 ■•■V\U 
is e\. Because Vf ll ■ ■ ■ V\U is unitary, it is of the form 



1 


' 




U' 



Now recursively find row operations to reduce V to the 
identity matrix. □ 
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Example 22. Wc will decompose the matrix U from 
Example [T8l We start with the first column u of U: 

-oj 3 + uj - 1 



V2* 



-1 



UJ 3 +UJ 2 



P3(u) 



1011 
0110 
1100 



0001 / \ 0001 



0001 
1010 
1010 



Rows 2 and 3 satisfy case 2 of Lemma [T9l As they are 
not aligned, first apply T? 2 3 , and then -ff[2,3]- Rows 1 and 
4 satisfy case 3. Applying fl"[ 14 ]T^ 4 j, the residues be- 
come P3(u'i) = 0011 and p 3 {u' 4 ) = 1001, which requires 
applying HumT\im. We now have 



H [1 ,4] ^[1,4] H [ lj4 ] Tji j4] [2i 3] T^j I 








0000 \ / 0000 

, v I 0000 I , t s / 0000 
W") =1 0110 ' = 1010 

0011 / V 1010 

Rows 3 and 4 satisfy case 2, while rows 1 and 2 arc 
already reduced. We reduce rows 3 and 4 by applying 
iJ[3 4]T[ 3j 4]. Continuing, the first column is completely 
reduced to e\ by further applying ujJ^X^^H^^Th 4 i. 
The complete decomposition of u is therefore given by 

h [ia]T[i A ]H[i A ]T[ 1A] H[2,3]T^ 3] . 

Applying this to the original matrix U, we have W%U = 

( \ff 

1 I lu' a -uj 2 +uj+1 -u) 2 -ui-l ui 2 

AJ 3 I aj 3 +aj 2 -aj+l u a +ui 2 -U}-l 

V/ \ ur i +w 2 +w+l J 2 u''-u> 2 +l 

Continuing with the rest of the columns, we find W2 = 
w f 2 ]#[2,4]^p i4 ]#[2,4]T[2, 4 ], W 3 = ujI 3] H [3A] T^ 4] H [3A] , and 

W 4 = . We then have U = W\ W\ W\ W\, or explic- 
itly: 

U = T [2,3] H [2,3] T [l,4]H[i A ]T^ A] H [1A] 
T, [3 ) 4]- ff [3,4]I 1 [3 ) 4]-ff[3,4]-X'[l,4]W[l] 

^[2,4] #[2,4] ^[2,4] #[2,4] W M #[3,4] 7)1,4] #[3,4] w f3] w f4] ■ 



5 Proof of Theorem [T] 

5.1 Equivalence of (a) and (b) 

First note that, since all the elementary Clifford+T 
gates, as shown in (fTJ), take their matrix entries in 
D[lu] — Z[-4=,i], the implication (a) =>■ (b) is trivial. 
For the converse, let U be a unitary 2 n x 2 n matrix with 
entries from ED[w]. By Lemma |2"T1 {/ can be decomposed 



into one- and two-level matrices of types A, H, T, and 
uj. It is well-known that each such matrix can be fur- 
ther decomposed into controlled-not gates and multiply- 
controlled X, H, T, and w-gates, for example using Gray 
codes [3 Sec. 4.5.2]. But all of these gates have well- 
known exact representations in Clifford+T with ancil- 
las, see e.g. [TJ Fig. 4(a) and Fig. 9] (and noting that a 
controlled-w gate is the same as a T-gate) . This finishes 
the proof of (b) => (a). 

5.2 One ancilla is sufficient 

The final claim that needs to be proved is that a circuit 
for U can always be found using at most one ancilla. It 
is already known that for n > 1, an ancilla is sometimes 
necessary [3J. To show that a single ancilla is sufficient, 
in light of the above decomposition, it is enough to show 
that the following can be implemented with one ancilla: 

(a) a multiply-controlled A-gate; 

(b) a multiply-controlled -ff-gate; 

(c) a multiply-controlled T-gate. 

We first recall from [1] Fig. 4(a)] that a singly-controlled 
Hadamard gate can be decomposed into Clifford+T 
gates with no ancillas: 



We also recall that an n-fold controlled iA-gate can be 
represented using 0(n) Clifford+T gates with no ancil- 
las. Namely, for n = 1, we have 



3> 



-©- 



and for n > 2, we can use 



with further decompositions of the multiply-controlled 
not-gates as in [3J Lem. 7.2] and Fig. 4.9]. We then 
obtain the following representations for (a)-(c), using 
only one ancilla: 



(a) 



(c) 



-m- 




iX 



5 




— m— 




H iX — ♦ — 




-m- o M^n-m-r^i— i 
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Remark 23. The fact that one ancilla is always suffi- 
cient in Theorem[T]is primarily of theoretical interest. In 
practice, one may assume that on most quantum com- 
puting architectures, ancillas are relatively cheap. More- 
over, the use of additional ancillas can significantly re- 
duce the size and depth of the generated circuits (see 
e.g. ©). 

6 The no-ancilla case 

Lemma 24. Under the hypotheses of Theorem [II as- 
sume that det U = 1. Then U can be exactly represented 
by a Clifford+T circuit with no ancillas. 

Proof. This requires only minor modifications to the 
proof of Theorem [T] First observe that whenever an 
operator of the form HT m was used in the proof of 
Lemma [T91 we can instead use T~ m (iH)T m without al- 
tering the rest of the argument. In the base case of 
Lemma |2"01 the operator -Xn^i can be replaced by iXun. 
Also, in the base case of Lemma [20l whenever n > 2, the 
operator w^j can be replaced by ITji^Jj where 



• detU e {-1,1}, ifn = 3; 

• det U £ {i, —1, — i, 1}, if n = 2; 



W 



oj 
oj- 1 



Therefore, the decomposition of Lemma 1211 can be per- 
formed so as to yield only two-level matrices of types 



iX, T- ,n {iH)T m , and W, 



(6) 



plus at most one one- level matrix of type oj m . But since 
all two-level matrices of types ©, as well as U itself, 
have determinant 1, it follows that oj m — 1. We finish 
the proof by observing that the multiply-controlled op- 
erators of types ([S]) possess ancilla-free Clifford+T rep- 
resentations, with the latter two given by 




□ 

As a corollary, we obtain a characterization of the n- 
qubit Clifford+T group (with no ancillas) for all n: 

Corollary 25. Let U be a unitary 2" x 2" matrix. Then 
the following are equivalent: 

(a) U can be exactly represented by a quantum circuit 
over the Clifford+T gate set on n qubits with no 
ancillas. 

(b) The entries of U belong to the ring Z[^,t], and: 

• AetU = 1, ifn > 4; 



• det U E {uj,i,uj 3 , -1, oj 5 , —i, oj 7 , 1}, ifn < 1. 

Proof. For (a) (b), it suffices to note that each of 
the generators of the Clifford+T group, regarded as an 
operation on n qubits, satisfies the conditions in (b). 
For (b) =>■ (a), let us define for convenience do = d± = oj, 
di = i, g?3 — — 1, and d n = 1 for n > 4. First note that 
for all n, the Clifford+T group on n qubits (without 
ancillas) contains an element D n whose determinant is 
dn, namely D n = I for n > 4, D 3 = T ® I ® I, D 2 = 
T (£> I, D\ — T, and Dq = uj. Now consider some U 
satisfying (b) . By assumption, det U = d™ for some 
m. Let U' = UD- rn , then det U' = 1. By Lemma [Ml 
U', and therefore U, is in the Clifford+T group with no 
ancillas. □ 

Remark 26. Note that the last condition in Corol- 
lary [5S1 namely that det U is a power of u for n < 1, 
is of course redundant, as this already follows from 
detU € and | det U\ = 1. We stated the con- 

dition for consistency with the case n > 2. 

Remark 27. The situation of Theorem []] and Corol- 
lary [25] is analogous to the case of classical reversible 
circuits. It is well-known that the not-gate, controlled- 
not gate, and Toffoli gate generate all classical reversible 
functions on n < 3 bits. For n > 4 bits, they generate 
exactly those reversible boolean functions that define an 
even permutation of their inputs (or equivalently, those 
that have determinant 1 when viewed in matrix form) 
[4] ; the addition of a single ancilla suffices to recover all 
boolean functions. 



7 Complexity 

The proof of Theorem Q] immediately yields an algo- 
rithm, albeit not a very efficient one, for synthesizing 
a Clifford+T circuit with ancillas from a given operator 
U. We estimate the size of the generated circuits. 

We first estimate the number of (one- and two-level) 
operations generated by the matrix decomposition of 
Lemma [2T1 The row operation from Lemma [T9l requires 
only a constant number of operations. Reducing a single 
n-dimensional column from denominator exponent k to 
k — 1, as in the induction step of Lemma 1201 requires 
O(n) operations; therefore, the number of operations re- 
quired to reduce the column completely is 0{nk). 

Now consider applying Lemma |2~T1 to an n x n- matrix 
with least denominator exponent k. Reducing the first 
column requires 0{nk) operations, but unfortunately, it 
may increase the least denominator exponent of the rest 
of the matrix, in the worst case, to 3k. Namely, each 
row operation of Lemma IT9l potentially increases the de- 
nominator exponent by 2, and any given row may be 
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subject to up to k row operations, resulting in a worst- 
case increase of its denominator exponent from k to 3k 
during the reduction of the first column. It follows that 
reducing the second column requires up to 0(3(n — l)fc) 
operations, reducing the third column requires up to 
0(9(n — 2)k) operations, and so on. Using the iden- 
tity J2]Zo 3 j ( n ~ j) = (3" +1 ~ 2 ™ - 3)/4, this results 
in a total of 0(3 n k) one- and two-level operations for 
Lemma [21] 

In the context of Theorem [1] we are dealing with n 
qubits, i.e., a 2™ x 2™-operator, which therefore decom- 
poses into 0(3 2 k) two-level operations. Using one an- 
cilla, each two-level operation can be decomposed into 
0(n) Clifford+T gates, resulting in a total gate count of 
0(3 2 nk) elementary Clifford+T gates. 

8 Future work 

As mentioned in the introduction, the algorithm arising 
out of the proof of Theorem [1] produces circuits that are 
very far from optimal. This can be seen heuristically 
by taking any simple Clifford+T circuit, calculating the 
corresponding operator, and then running the algorithm 
to re-synthesize a circuit. 

Moreover, it is unlikely that the algorithm is optimal 
even in the asymptotic sense. The algorithm's worst case 
gate count of 0(3 2 nk) is separated from information- 
theoretic lower bounds by an exponential gap. Specifi- 
cally, the number of different unitary n-qubit operators 
with denominator exponent k can be bounded: for n > 1, 
it is between 2 2 k and 2 4 ( 4+2fc ). Therefore, such an 
operator carries between f2(2"fc) and 0(A n k) bits of in- 
formation. Regardless of where the true number falls 
within this spectrum, the resulting information-theoretic 
lower bound for the number of elementary gates required 
to represent such an operator is exponential, not super- 
exponential, in n. 

While the information-theoretic analysis does of 
course not imply the existence of an asymptotically bet- 
ter synthesis algorithm, it nevertheless suggests that it 
may be worthwhile to look for one. 

Given that the gate count estimate is dominated by 
the term 3 2 , the most obvious target for improvement 
is the part of the algorithm that causes this super- 
exponential blowup. As noted above, this blowup is 
caused by the fact that row reductions that reduce the 
denominator exponent of one column might simultane- 
ously increase the denominator exponent of the remain- 
ing columns. 
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